@contember/engine-tenant-api 2.1.0-beta.2 → 2.2.0-alpha.1

package/dist/types/model/service/OtpManager.d.ts

@@ -1,13 +1,28 @@
-import { PersonRow } from '../queries';
-import { DatabaseContext } from '../utils';
-import { OtpAuthenticator, OtpData } from './OtpAuthenticator';
+import { PersonRow } from '../queries/index.js';
+import { DatabaseContext } from '../utils/index.js';
+import { OtpAuthenticator, OtpData } from './OtpAuthenticator.js';
+import { Providers } from '../providers.js';
 export declare class OtpManager {
     private readonly otpAuthenticator;
-    constructor(otpAuthenticator: OtpAuthenticator);
+    private readonly providers;
+    constructor(otpAuthenticator: OtpAuthenticator, providers: Pick<Providers, 'decrypt' | 'encrypt' | 'encryptionEnabled'>);
     prepareOtp(dbContext: DatabaseContext, person: PersonRow, label: string): Promise<OtpData>;
-    confirmOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void>;
+    /** Promotes the pending TOTP secret to active. Returns false if there was no pending secret to promote (e.g. a lost concurrent confirm). */
+    confirmOtp(dbContext: DatabaseContext, person: PersonRow): Promise<boolean>;
     disableOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void>;
-    verifyOtp(person: PersonRow, token: string): boolean;
+    /** Verifies a token against the person's *active* TOTP secret. */
+    verifyOtp(dbContext: DatabaseContext, person: PersonRow, token: string): Promise<boolean>;
+    /** Verifies a token against the person's *pending* TOTP secret (used during enrollment). */
+    verifyPendingOtp(person: PersonRow, token: string): Promise<boolean>;
+    /**
+     * Resolves the stored secret bytes into something the authenticator understands.
+     * Version 0 = legacy plaintext otpauth URI. Version >= 1 = encrypted base32 secret.
+     *
+     * Also surfaces whether the active secret warrants opportunistic re-encryption:
+     * version-0 (legacy plaintext) always does; version>=1 does when the encryption
+     * layer signals the key has rotated (`needsReEncrypt`).
+     */
+    private resolveSecret;
 }
 export declare class OtpError extends Error {
 }

package/dist/types/model/service/OtpManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OtpManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/OtpManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAEtC,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAE9D,qBAAa,UAAU;IAErB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;gBAAhB,gBAAgB,EAAE,gBAAgB;IAG9C,UAAU,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAM1F,UAAU,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxE,UAAU,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9E,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;CAMpD;AAED,qBAAa,QAAS,SAAQ,KAAK;CAClC"}
+{"version":3,"file":"OtpManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/OtpManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAgB3C,qBAAa,UAAU;IAErB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,gBAAgB,EAAE,gBAAgB,EAClC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,GAAG,mBAAmB,CAAC;IAGnF,UAAU,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAehG,4IAA4I;IACtI,UAAU,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAI3E,UAAU,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9E,kEAAkE;IAC5D,SAAS,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAmB/F,4FAA4F;IACtF,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK1E;;;;;;;OAOG;YACW,aAAa;CAkB3B;AAED,qBAAa,QAAS,SAAQ,KAAK;CAClC"}

package/dist/types/model/service/PasswordChangeManager.d.ts

@@ -1,9 +1,9 @@
-import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode, WeakPasswordReason } from '../../schema';
-import { Response } from '../utils/Response';
-import { PersonRow } from '../queries';
-import { Providers } from '../providers';
-import { DatabaseContext } from '../utils';
-import { PasswordStrengthValidator } from './PasswordStrengthValidator';
+import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode, WeakPasswordReason } from '../../schema/index.js';
+import { Response } from '../utils/Response.js';
+import { PersonRow } from '../queries/index.js';
+import { Providers } from '../providers.js';
+import { DatabaseContext } from '../utils/index.js';
+import { PasswordStrengthValidator } from './PasswordStrengthValidator.js';
 declare class PasswordChangeManager {
     private readonly providers;
     private readonly passwordStrengthVerifier;

package/dist/types/model/service/PasswordChangeManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordChangeManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/PasswordChangeManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAErG,OAAO,EAAE,QAAQ,EAA6B,MAAM,mBAAmB,CAAA;AACvE,OAAO,EAAsB,SAAS,EAAE,MAAM,YAAY,CAAA;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAA;AAEvE,cAAM,qBAAqB;IAEzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,wBAAwB;gBADxB,SAAS,EAAE,SAAS,EACpB,wBAAwB,EAAE,yBAAyB;IAG/D,cAAc,CACnB,SAAS,EAAE,eAAe,EAC1B,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,qBAAqB,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,CAAC;IAU3E,gBAAgB,CACrB,SAAS,EAAE,eAAe,EAC1B,MAAM,EAAE,SAAS,EACjB,eAAe,EAAE,MAAM,EACvB,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,qBAAqB,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,CAAC;CAgBnF;AAED,kBAAU,qBAAqB,CAAC;IAC/B,KAAY,sBAAsB,CAAC,CAAC,SAAS,uBAAuB,GAAG,yBAAyB,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE;QACrH,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAA;KAC1C,CAAC,CAAA;CACF;AAED,OAAO,EAAE,qBAAqB,EAAE,CAAA"}
+{"version":3,"file":"PasswordChangeManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/PasswordChangeManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAE9G,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAsB,SAAS,EAAE,MAAM,qBAAqB,CAAA;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAE1E,cAAM,qBAAqB;IAEzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,wBAAwB;gBADxB,SAAS,EAAE,SAAS,EACpB,wBAAwB,EAAE,yBAAyB;IAG/D,cAAc,CACnB,SAAS,EAAE,eAAe,EAC1B,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,qBAAqB,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,CAAC;IAU3E,gBAAgB,CACrB,SAAS,EAAE,eAAe,EAC1B,MAAM,EAAE,SAAS,EACjB,eAAe,EAAE,MAAM,EACvB,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,qBAAqB,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,CAAC;CAgBnF;AAED,kBAAU,qBAAqB,CAAC;IAC/B,KAAY,sBAAsB,CAAC,CAAC,SAAS,uBAAuB,GAAG,yBAAyB,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE;QACrH,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAA;KAC1C,CAAC,CAAA;CACF;AAED,OAAO,EAAE,qBAAqB,EAAE,CAAA"}

package/dist/types/model/service/PasswordResetManager.d.ts

@@ -1,12 +1,12 @@
-import { Response } from '../utils/Response';
-import { UserMailer } from '../mailing';
-import { PersonRow } from '../queries';
-import { PermissionContext } from '../authorization';
-import { ProjectManager } from './ProjectManager';
-import { DatabaseContext } from '../utils';
-import { PasswordStrengthValidator } from './PasswordStrengthValidator';
-import { ResetPasswordErrorCode, WeakPasswordReason } from '../../schema';
-import { AuthLogService } from './AuthLogService';
+import { Response } from '../utils/Response.js';
+import { UserMailer } from '../mailing/index.js';
+import { PersonRow } from '../queries/index.js';
+import { PermissionContext } from '../authorization/index.js';
+import { ProjectManager } from './ProjectManager.js';
+import { DatabaseContext } from '../utils/index.js';
+import { PasswordStrengthValidator } from './PasswordStrengthValidator.js';
+import { ResetPasswordErrorCode, WeakPasswordReason } from '../../schema/index.js';
+import { AuthLogService } from './AuthLogService.js';
 interface MailOptions {
     project?: string;
     mailVariant?: string;

package/dist/types/model/service/PasswordResetManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordResetManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/PasswordResetManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA6B,MAAM,mBAAmB,CAAA;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,EAAsB,SAAS,EAAE,MAAM,YAAY,CAAA;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAI1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAA;AACvE,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAEzE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEjD,UAAU,WAAW;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,oBAAoB;IAE/B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,yBAAyB;gBAFzB,MAAM,EAAE,UAAU,EAClB,cAAc,EAAE,cAAc,EAC9B,yBAAyB,EAAE,yBAAyB;IAGzD,0BAA0B,CACtC,SAAS,EAAE,eAAe,EAC1B,iBAAiB,EAAE,iBAAiB,EACpC,MAAM,EAAE,SAAS,EACjB,WAAW,GAAE,WAAgB,GAC3B,OAAO,CAAC,IAAI,CAAC;IAuBH,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;CA+BvH;AAED,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAC3C;IACC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CACxC,EACD,sBAAsB,EACtB;IACC,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAA;IAC1C,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CACxC,CACD,CAAA"}
+{"version":3,"file":"PasswordResetManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/PasswordResetManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAsB,SAAS,EAAE,MAAM,qBAAqB,CAAA;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAInD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC1E,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAElF,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAGpD,UAAU,WAAW;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,oBAAoB;IAE/B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,yBAAyB;gBAFzB,MAAM,EAAE,UAAU,EAClB,cAAc,EAAE,cAAc,EAC9B,yBAAyB,EAAE,yBAAyB;IAGzD,0BAA0B,CACtC,SAAS,EAAE,eAAe,EAC1B,iBAAiB,EAAE,iBAAiB,EACpC,MAAM,EAAE,SAAS,EACjB,WAAW,GAAE,WAAgB,GAC3B,OAAO,CAAC,IAAI,CAAC;IAkCH,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;CA+BvH;AAED,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAC3C;IACC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CACxC,EACD,sBAAsB,EACtB;IACC,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAA;IAC1C,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CACxC,CACD,CAAA"}

package/dist/types/model/service/PasswordStrengthValidator.d.ts

@@ -1,7 +1,10 @@
-import { Config } from '../type/Config';
-import { WeakPasswordReason } from '../../schema';
-import { ResponseError, ResponseOk } from '../utils/Response';
+import { Config } from '../type/Config.js';
+import { WeakPasswordReason } from '../../schema/index.js';
+import { ResponseError, ResponseOk } from '../utils/Response.js';
+import { HibpChecker } from './HibpChecker.js';
 export declare class PasswordStrengthValidator {
+    private readonly hibpChecker;
+    constructor(hibpChecker?: HibpChecker);
     verify<const Code extends string>(password: string, passwordConfig: Config['password'], errorCode: Code): Promise<ResponseOk<null> | ResponseError<Code, {
         weakPasswordReasons: WeakPasswordReason[];
     }>>;

package/dist/types/model/service/PasswordStrengthValidator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordStrengthValidator.d.ts","sourceRoot":"","sources":["../../../../src/model/service/PasswordStrengthValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAEvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACjD,OAAO,EAAY,aAAa,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAEvE,qBAAa,yBAAyB;IACxB,MAAM,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EAC5C,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,EAClC,SAAS,EAAE,IAAI,GACb,OAAO,CACP,UAAU,CAAC,IAAI,CAAC,GAChB,aAAa,CAAC,IAAI,EAAE;QACrB,mBAAmB,EAAE,kBAAkB,EAAE,CAAA;KACzC,CAAC,CACF;IAqDD,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,eAAe;CAiBvB"}
+{"version":3,"file":"PasswordStrengthValidator.d.ts","sourceRoot":"","sources":["../../../../src/model/service/PasswordStrengthValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAE1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,EAAY,aAAa,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,WAAW,EAAmB,MAAM,kBAAkB,CAAA;AAE/D,qBAAa,yBAAyB;IAEpC,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,GAAE,WAAmC;IAGrD,MAAM,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EAC5C,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,EAClC,SAAS,EAAE,IAAI,GACb,OAAO,CACP,UAAU,CAAC,IAAI,CAAC,GAChB,aAAa,CAAC,IAAI,EAAE;QACrB,mBAAmB,EAAE,kBAAkB,EAAE,CAAA;KACzC,CAAC,CACF;IA0DD,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,eAAe;CAiBvB"}

package/dist/types/model/service/PasswordlessSignInManager.d.ts

@@ -1,20 +1,23 @@
-import { ApiKeyManager } from './apiKey';
-import { PersonRow } from '../queries';
-import { Response } from '../utils/Response';
-import { ActivatePasswordlessOtpErrorCode, InitSignInPasswordlessErrorCode, InitSignInPasswordlessResult, SignInPasswordlessErrorCode } from '../../schema';
-import { DatabaseContext } from '../utils';
-import { UserMailer } from '../mailing';
-import { ProjectManager } from './ProjectManager';
-import { PermissionContext } from '../authorization';
-import { OtpAuthenticator } from './OtpAuthenticator';
-import { PersonToken } from '../type';
-import { AuthLogService } from './AuthLogService';
+import { ApiKeyManager } from './apiKey/index.js';
+import { PersonRow } from '../queries/index.js';
+import { Response } from '../utils/Response.js';
+import { ActivatePasswordlessOtpErrorCode, InitSignInPasswordlessErrorCode, InitSignInPasswordlessResult, SignInPasswordlessErrorCode } from '../../schema/index.js';
+import { DatabaseContext } from '../utils/index.js';
+import { UserMailer } from '../mailing/index.js';
+import { ApiKeyRequestInfo } from '../commands/index.js';
+import { ProjectManager } from './ProjectManager.js';
+import { PermissionContext } from '../authorization/index.js';
+import { OtpManager } from './OtpManager.js';
+import { BackupCodeManager } from './BackupCodeManager.js';
+import { PersonToken } from '../type/index.js';
+import { AuthLogService } from './AuthLogService.js';
 declare class PasswordlessSignInManager {
     private readonly apiKeyManager;
     private readonly mailer;
     private readonly projectManager;
-    private readonly otpAuthenticator;
-    constructor(apiKeyManager: ApiKeyManager, mailer: UserMailer, projectManager: ProjectManager, otpAuthenticator: OtpAuthenticator);
+    private readonly otpManager;
+    private readonly backupCodeManager;
+    constructor(apiKeyManager: ApiKeyManager, mailer: UserMailer, projectManager: ProjectManager, otpManager: OtpManager, backupCodeManager: BackupCodeManager);
     initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }: {
         db: DatabaseContext;
         permissionContext: PermissionContext;
@@ -23,13 +26,16 @@ declare class PasswordlessSignInManager {
         mailProject?: string;
     }): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse>;
     private formatUrl;
-    signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }: {
+    signInPasswordless({ db, expiration, token, requestId, mfaOtp, backupCode, validationType, requestInfo, trustForwardedInfo }: {
         db: DatabaseContext;
         validationType: PersonToken.ValidationType;
         requestId: string;
         token: string;
         mfaOtp?: string;
+        backupCode?: string;
         expiration?: number;
+        requestInfo?: ApiKeyRequestInfo;
+        trustForwardedInfo?: boolean;
     }): Promise<PasswordlessSignInManager.SignInPasswordlessResponse>;
     activatePasswordlessOtp({ db, token, requestId, otpHash }: {
         db: DatabaseContext;
@@ -37,7 +43,6 @@ declare class PasswordlessSignInManager {
         token: string;
         otpHash: string;
     }): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse>;
-    private isEnabled;
 }
 declare namespace PasswordlessSignInManager {
     export type InitSignInPasswordlessResponse = Response<InitSignInPasswordlessResult & {
@@ -48,6 +53,8 @@ declare namespace PasswordlessSignInManager {
     interface SignInPasswordlessResult {
         readonly person: PersonRow;
         readonly token: string;
+        /** True when MFA was satisfied by consuming a backup code (instead of a TOTP token). */
+        readonly usedBackupCode?: boolean;
         [AuthLogService.Key]: AuthLogService.Bag;
     }
     export type SignInPasswordlessResponse = Response<SignInPasswordlessResult, SignInPasswordlessErrorCode, {

package/dist/types/model/service/PasswordlessSignInManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordlessSignInManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/PasswordlessSignInManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAmC,SAAS,EAAE,MAAM,YAAY,CAAA;AACvE,OAAO,EAAE,QAAQ,EAA6B,MAAM,mBAAmB,CAAA;AACvE,OAAO,EACN,gCAAgC,EAEhC,+BAA+B,EAC/B,4BAA4B,EAC5B,2BAA2B,EAC3B,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,eAAe,EAAiB,MAAM,UAAU,CAAA;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAGvC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAGpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAGjD,cAAM,yBAAyB;IAE7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;gBAHhB,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,UAAU,EAClB,cAAc,EAAE,cAAc,EAC9B,gBAAgB,EAAE,gBAAgB;IAG9C,sBAAsB,CAAC,EAAE,EAAE,EAAE,iBAAiB,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;QACxF,EAAE,EAAE,eAAe,CAAA;QACnB,iBAAiB,EAAE,iBAAiB,CAAA;QACpC,KAAK,EAAE,MAAM,CAAA;QACb,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,WAAW,CAAC,EAAE,MAAM,CAAA;KACpB,GAAG,OAAO,CAAC,yBAAyB,CAAC,8BAA8B,CAAC;IA8DrE,OAAO,CAAC,SAAS;IAWX,kBAAkB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE;QACtF,EAAE,EAAE,eAAe,CAAA;QACnB,cAAc,EAAE,WAAW,CAAC,cAAc,CAAA;QAC1C,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,EAAE,MAAM,CAAA;QACb,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,UAAU,CAAC,EAAE,MAAM,CAAA;KACnB,GAAG,OAAO,CAAC,yBAAyB,CAAC,0BAA0B,CAAC;IAuE3D,uBAAuB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;QAChE,EAAE,EAAE,eAAe,CAAA;QACnB,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,EAAE,MAAM,CAAA;QACb,OAAO,EAAE,MAAM,CAAA;KACf,GAAG,OAAO,CAAC,yBAAyB,CAAC,+BAA+B,CAAC;IA+BtE,OAAO,CAAC,SAAS;CAYjB;AAED,kBAAU,yBAAyB,CAAC;IACnC,MAAM,MAAM,8BAA8B,GAAG,QAAQ,CACpD,4BAA4B,GAAG;QAC9B,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC,EACD,+BAA+B,EAC/B;QACC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC,CACD,CAAA;IAED,UAAU,wBAAwB;QACjC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;QAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;QACtB,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC;IACD,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC,wBAAwB,EAAE,2BAA2B,EAAE;QACxG,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC,CAAC,CAAA;IAEF,MAAM,MAAM,+BAA+B,GAAG,QAAQ,CACrD;QACC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC,EACD,gCAAgC,EAChC;QACC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC,CACD,CAAA;;CACD;AAED,OAAO,EAAE,yBAAyB,EAAE,CAAA"}
+{"version":3,"file":"PasswordlessSignInManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/PasswordlessSignInManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAmC,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAChF,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EACN,gCAAgC,EAChC,+BAA+B,EAC/B,4BAA4B,EAC5B,2BAA2B,EAC3B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,eAAe,EAAiB,MAAM,mBAAmB,CAAA;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAEN,iBAAiB,EAKjB,MAAM,sBAAsB,CAAA;AAG7B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAG7D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAIpD,cAAM,yBAAyB;IAE7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAJjB,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,UAAU,EAClB,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,UAAU,EACtB,iBAAiB,EAAE,iBAAiB;IAGhD,sBAAsB,CAAC,EAAE,EAAE,EAAE,iBAAiB,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;QACxF,EAAE,EAAE,eAAe,CAAA;QACnB,iBAAiB,EAAE,iBAAiB,CAAA;QACpC,KAAK,EAAE,MAAM,CAAA;QACb,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,WAAW,CAAC,EAAE,MAAM,CAAA;KACpB,GAAG,OAAO,CAAC,yBAAyB,CAAC,8BAA8B,CAAC;IAkFrE,OAAO,CAAC,SAAS;IAWX,kBAAkB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,kBAAkB,EAAE,EAAE;QACnI,EAAE,EAAE,eAAe,CAAA;QACnB,cAAc,EAAE,WAAW,CAAC,cAAc,CAAA;QAC1C,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,EAAE,MAAM,CAAA;QACb,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,WAAW,CAAC,EAAE,iBAAiB,CAAA;QAC/B,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAC5B,GAAG,OAAO,CAAC,yBAAyB,CAAC,0BAA0B,CAAC;IAoG3D,uBAAuB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;QAChE,EAAE,EAAE,eAAe,CAAA;QACnB,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,EAAE,MAAM,CAAA;QACb,OAAO,EAAE,MAAM,CAAA;KACf,GAAG,OAAO,CAAC,yBAAyB,CAAC,+BAA+B,CAAC;CA8BtE;AAED,kBAAU,yBAAyB,CAAC;IACnC,MAAM,MAAM,8BAA8B,GAAG,QAAQ,CACpD,4BAA4B,GAAG;QAC9B,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC,EACD,+BAA+B,EAC/B;QACC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC,CACD,CAAA;IAED,UAAU,wBAAwB;QACjC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;QAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;QACtB,wFAAwF;QACxF,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;QACjC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC;IACD,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC,wBAAwB,EAAE,2BAA2B,EAAE;QACxG,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC,CAAC,CAAA;IAEF,MAAM,MAAM,+BAA+B,GAAG,QAAQ,CACrD;QACC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC,EACD,gCAAgC,EAChC;QACC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC,CACD,CAAA;;CACD;AAED,OAAO,EAAE,yBAAyB,EAAE,CAAA"}

package/dist/types/model/service/PersonAccessManager.d.ts

@@ -1,8 +1,8 @@
-import { PersonRow } from '../queries';
-import { DatabaseContext } from '../utils';
-import { ApiKeyManager } from './apiKey';
-import { Response } from '../utils/Response';
-import { DisablePersonErrorCode } from '../../schema';
+import { PersonRow } from '../queries/index.js';
+import { DatabaseContext } from '../utils/index.js';
+import { ApiKeyManager } from './apiKey/index.js';
+import { Response } from '../utils/Response.js';
+import { DisablePersonErrorCode } from '../../schema/index.js';
 declare class PersonAccessManager {
     private readonly apiKeyManager;
     constructor(apiKeyManager: ApiKeyManager);

package/dist/types/model/service/PersonAccessManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PersonAccessManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/PersonAccessManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,SAAS,EAAE,MAAM,YAAY,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAE1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,QAAQ,EAA6B,MAAM,mBAAmB,CAAA;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AAErD,cAAM,mBAAmB;IACZ,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAAb,aAAa,EAAE,aAAa;IAEnD,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,2BAA2B,CAAC;YAc1F,oBAAoB;YAIpB,sBAAsB;CAGpC;AAED,MAAM,MAAM,2BAA2B,GAAG,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAA;AAEhF,OAAO,EAAE,mBAAmB,EAAE,CAAA"}
+{"version":3,"file":"PersonAccessManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/PersonAccessManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAE9D,cAAM,mBAAmB;IACZ,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAAb,aAAa,EAAE,aAAa;IAEnD,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,2BAA2B,CAAC;YAc1F,oBAAoB;YAIpB,sBAAsB;CAGpC;AAED,MAAM,MAAM,2BAA2B,GAAG,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAA;AAEhF,OAAO,EAAE,mBAAmB,EAAE,CAAA"}

package/dist/types/model/service/PersonManager.d.ts

@@ -1,12 +1,13 @@
-import { ChangeProfileData } from '../commands/person/ChangeProfileCommand';
-import { Response } from '../utils/Response';
-import { PersonRow } from '../queries';
-import { DatabaseContext } from '../utils';
-import { EmailValidator, EmailValidatorError } from './EmailValidator';
+import { ChangeProfileData } from '../commands/person/ChangeProfileCommand.js';
+import { Response } from '../utils/Response.js';
+import { PersonListRow, PersonRow, PersonsQueryFilter } from '../queries/index.js';
+import { DatabaseContext } from '../utils/index.js';
+import { EmailValidator, EmailValidatorError } from './EmailValidator.js';
 declare class PersonManager {
     private readonly emailValidator;
     constructor(emailValidator: EmailValidator);
     findPersonById(dbContext: DatabaseContext, personId: string): Promise<PersonRow | null>;
+    listPersons(dbContext: DatabaseContext, filter?: PersonsQueryFilter, limit?: number | null, offset?: number | null): Promise<PersonListRow[]>;
     changeProfile(dbContext: DatabaseContext, person: PersonRow, data: ChangeProfileData): Promise<PersonManager.ProfileChangeResponse>;
     togglePasswordless(dbContext: DatabaseContext, person: PersonRow, value: boolean): Promise<Response<null, never>>;
 }

package/dist/types/model/service/PersonManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PersonManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/PersonManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,iBAAiB,EAAE,MAAM,yCAAyC,CAAA;AACjG,OAAO,EAAE,QAAQ,EAA6B,MAAM,mBAAmB,CAAA;AACvE,OAAO,EAAe,SAAS,EAAE,MAAM,YAAY,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAGtE,cAAM,aAAa;IAEjB,OAAO,CAAC,QAAQ,CAAC,cAAc;gBAAd,cAAc,EAAE,cAAc;IAI1C,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAMvF,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,qBAAqB,CAAC;IAWnI,kBAAkB,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;CAIvH;AAED,kBAAU,aAAa,CAAC;IACvB,KAAY,qBAAqB,GAAG,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAA;CACvE;AAED,OAAO,EAAE,aAAa,EAAE,CAAA"}
+{"version":3,"file":"PersonManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/PersonManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,iBAAiB,EAAE,MAAM,4CAA4C,CAAA;AACpG,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,aAAa,EAAe,SAAS,EAAgB,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAC7G,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAIzE,cAAM,aAAa;IAEjB,OAAO,CAAC,QAAQ,CAAC,cAAc;gBAAd,cAAc,EAAE,cAAc;IAI1C,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAMvF,WAAW,CAChB,SAAS,EAAE,eAAe,EAC1B,MAAM,GAAE,kBAAuB,EAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,EACrB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACpB,OAAO,CAAC,aAAa,EAAE,CAAC;IAIrB,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,qBAAqB,CAAC;IAmBnI,kBAAkB,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;CAIvH;AAED,kBAAU,aAAa,CAAC;IACvB,KAAY,qBAAqB,GAAG,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAA;CACvE;AAED,OAAO,EAAE,aAAa,EAAE,CAAA"}

package/dist/types/model/service/ProjectManager.d.ts

@@ -1,10 +1,10 @@
-import { PermissionContext } from '../authorization';
-import { Project, ProjectInitializer, ProjectWithSecrets } from '../type';
-import { SecretsManager } from './SecretsManager';
-import { DatabaseContext, TokenHash } from '../utils';
-import { ApiKeyService, CreateApiKeyResult } from './apiKey';
-import { Response } from '../utils/Response';
-import { CreateProjectResponseErrorCode } from '../../schema';
+import { PermissionContext } from '../authorization/index.js';
+import { Project, ProjectInitializer, ProjectWithSecrets } from '../type/index.js';
+import { SecretsManager } from './SecretsManager.js';
+import { DatabaseContext, TokenHash } from '../utils/index.js';
+import { ApiKeyService, CreateApiKeyResult } from './apiKey/index.js';
+import { Response } from '../utils/Response.js';
+import { CreateProjectResponseErrorCode } from '../../schema/index.js';
 import { Logger } from '@contember/logger';
 export declare class ProjectManager {
     private readonly secretManager;

package/dist/types/model/service/ProjectManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/ProjectManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAEzE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAIrD,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC5D,OAAO,EAAE,QAAQ,EAA6B,MAAM,mBAAmB,CAAA;AACvE,OAAO,EAAE,8BAA8B,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAE1C,qBAAa,cAAc;IAEzB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAFb,aAAa,EAAE,cAAc,EAC7B,iBAAiB,EAAE,kBAAkB,EACrC,aAAa,EAAE,aAAa;IAGjC,aAAa,CACzB,SAAS,EAAE,eAAe,EAC1B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC,EACzE,OAAO,EAAE;QACR,eAAe,CAAC,EAAE,MAAM,CAAA;QACxB,eAAe,CAAC,EAAE,SAAS,CAAA;QAC3B,aAAa,CAAC,EAAE,OAAO,CAAA;KACvB,GACC,OAAO,CAAC,qBAAqB,CAAC;IA8CpB,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrH,gBAAgB,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAInF,eAAe,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;IAQtH,2BAA2B,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IASzH,WAAW,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAI3D,qBAAqB,CAAC,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;CAG5I;AAED,qBAAa,gBAAiB,SAAQ,KAAK;CAAG;AAE9C,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC,mBAAmB,EAAE,8BAA8B,CAAC,CAAA;AAEjG,qBAAa,mBAAmB;aACH,cAAc,CAAC,EAAE,kBAAkB;gBAAnC,cAAc,CAAC,EAAE,kBAAkB,YAAA;CAE/D"}
+{"version":3,"file":"ProjectManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/ProjectManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAElF,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAI9D,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACrE,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAA;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAE1C,qBAAa,cAAc;IAEzB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAFb,aAAa,EAAE,cAAc,EAC7B,iBAAiB,EAAE,kBAAkB,EACrC,aAAa,EAAE,aAAa;IAGjC,aAAa,CACzB,SAAS,EAAE,eAAe,EAC1B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC,EACzE,OAAO,EAAE;QACR,eAAe,CAAC,EAAE,MAAM,CAAA;QACxB,eAAe,CAAC,EAAE,SAAS,CAAA;QAC3B,aAAa,CAAC,EAAE,OAAO,CAAA;KACvB,GACC,OAAO,CAAC,qBAAqB,CAAC;IA8CpB,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrH,gBAAgB,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAInF,eAAe,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;IAQtH,2BAA2B,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IASzH,WAAW,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAI3D,qBAAqB,CAAC,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;CAG5I;AAED,qBAAa,gBAAiB,SAAQ,KAAK;CAAG;AAE9C,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC,mBAAmB,EAAE,8BAA8B,CAAC,CAAA;AAEjG,qBAAa,mBAAmB;aACH,cAAc,CAAC,EAAE,kBAAkB;gBAAnC,cAAc,CAAC,EAAE,kBAAkB,YAAA;CAE/D"}

package/dist/types/model/service/ProjectMemberManager.d.ts

@@ -1,9 +1,9 @@
-import { MembershipUpdateInput, RemoveProjectMemberResponse, UpdateProjectMemberResponse } from '../commands';
-import { AddProjectMemberErrorCode, ProjectMembersInput } from '../../schema';
-import { AccessVerifier } from '../authorization';
+import { MembershipUpdateInput, RemoveProjectMemberResponse, UpdateProjectMemberResponse } from '../commands/index.js';
+import { AddProjectMemberErrorCode, ProjectMembersInput } from '../../schema/index.js';
+import { AccessVerifier } from '../authorization/index.js';
 import { Acl } from '@contember/schema';
-import { Response } from '../utils/Response';
-import { DatabaseContext } from '../utils';
+import { Response } from '../utils/Response.js';
+import { DatabaseContext } from '../utils/index.js';
 export declare class ProjectMemberManager {
     addProjectMember(dbContext: DatabaseContext, projectId: string, identityId: string, memberships: readonly Acl.Membership[]): Promise<AddProjectMemberResponse>;
     updateProjectMember(dbContext: DatabaseContext, projectId: string, identityId: string, memberships: readonly MembershipUpdateInput[]): Promise<UpdateProjectMemberResponse>;

package/dist/types/model/service/ProjectMemberManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectMemberManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/ProjectMemberManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAEN,qBAAqB,EAErB,2BAA2B,EAE3B,2BAA2B,EAC3B,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAiC,MAAM,kBAAkB,CAAA;AAGhF,OAAO,EAAE,GAAG,EAAe,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAE1C,qBAAa,oBAAoB;IAC1B,gBAAgB,CACrB,SAAS,EAAE,eAAe,EAC1B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,GACpC,OAAO,CAAC,wBAAwB,CAAC;IAQ9B,mBAAmB,CACxB,SAAS,EAAE,eAAe,EAC1B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,SAAS,qBAAqB,EAAE,GAC3C,OAAO,CAAC,2BAA2B,CAAC;IAMjC,mBAAmB,CAAC,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAM5H,wBAAwB,CAC7B,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAC1C,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EACnD,QAAQ,EAAE,cAAc,GAAG,SAAS,GAClC,OAAO,CAAC,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC;IAO/B,8BAA8B,CACnC,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAC1C,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GACjD,OAAO,CAAC,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC;IAQ/B,4BAA4B,CACjC,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAC1C,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EACxB,QAAQ,EAAE,cAAc,GAAG,SAAS,GAClC,OAAO,CAAC,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC;IAUrC,OAAO,CAAC,6BAA6B;IAO/B,iBAAiB,CACtB,SAAS,EAAE,eAAe,EAC1B,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,cAAc,EAC9B,KAAK,EAAE,mBAAmB,GACxB,OAAO,CAAC,yBAAyB,CAAC;YAiBvB,iBAAiB;YAuBjB,qCAAqC;CAyBnD;AAED,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAA;AAEhF,MAAM,MAAM,yBAAyB,GAAG;IACvC,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACxB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,CAAA;CACtC,EAAE,CAAA"}
+{"version":3,"file":"ProjectMemberManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/ProjectMemberManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAEN,qBAAqB,EAErB,2BAA2B,EAE3B,2BAA2B,EAC3B,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AACtF,OAAO,EAAE,cAAc,EAAiC,MAAM,2BAA2B,CAAA;AAGzF,OAAO,EAAE,GAAG,EAAe,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,qBAAa,oBAAoB;IAC1B,gBAAgB,CACrB,SAAS,EAAE,eAAe,EAC1B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,GACpC,OAAO,CAAC,wBAAwB,CAAC;IAQ9B,mBAAmB,CACxB,SAAS,EAAE,eAAe,EAC1B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,SAAS,qBAAqB,EAAE,GAC3C,OAAO,CAAC,2BAA2B,CAAC;IAMjC,mBAAmB,CAAC,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAM5H,wBAAwB,CAC7B,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAC1C,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EACnD,QAAQ,EAAE,cAAc,GAAG,SAAS,GAClC,OAAO,CAAC,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC;IAO/B,8BAA8B,CACnC,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAC1C,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GACjD,OAAO,CAAC,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC;IAQ/B,4BAA4B,CACjC,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAC1C,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EACxB,QAAQ,EAAE,cAAc,GAAG,SAAS,GAClC,OAAO,CAAC,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC;IAUrC,OAAO,CAAC,6BAA6B;IAO/B,iBAAiB,CACtB,SAAS,EAAE,eAAe,EAC1B,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,cAAc,EAC9B,KAAK,EAAE,mBAAmB,GACxB,OAAO,CAAC,yBAAyB,CAAC;YAiBvB,iBAAiB;YAuBjB,qCAAqC;CAyBnD;AAED,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAA;AAEhF,MAAM,MAAM,yBAAyB,GAAG;IACvC,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACxB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,CAAA;CACtC,EAAE,CAAA"}

package/dist/types/model/service/RateLimiter.d.ts

@@ -0,0 +1,46 @@
+import { DatabaseContext } from '../utils/index.js';
+import { Providers } from '../providers.js';
+import { Config } from '../type/Config.js';
+import { RateLimitScope } from '../type/RateLimit.js';
+export interface RateLimitWindow {
+    readonly limit: number;
+    readonly window: {};
+}
+export interface RateLimitDecision {
+    readonly ok: boolean;
+    readonly retryAfterSeconds?: number;
+}
+/**
+ * Sliding-window rate limiter backed by the `rate_limit_event` table.
+ *
+ * Cost: one COUNT(*) and (on success) one INSERT per check. The event row is
+ * recorded only when the call passes — denied calls do not extend the window,
+ * matching the spec's "max N successful attempts per window".
+ *
+ * The raw key (IP, email, ...) is hashed with the configured provider so the
+ * raw value is not stored at rest. Note this is pseudonymization, not strong
+ * anonymization: an unsalted SHA-256 of a low-entropy input (e.g. an IPv4
+ * address) is recoverable by brute force, so treat key_hash as sensitive.
+ */
+export declare class RateLimiter {
+    private readonly providers;
+    constructor(providers: Pick<Providers, 'hash' | 'now'>);
+    private hashKey;
+    private resolveWindow;
+    /**
+     * Check whether the next attempt fits within the configured window without
+     * recording it. Use {@link record} after a successful gating decision.
+     */
+    check(db: DatabaseContext, scope: RateLimitScope, key: string, config: Config): Promise<RateLimitDecision>;
+    record(db: DatabaseContext, scope: RateLimitScope, key: string): Promise<void>;
+    /**
+     * Combined check + record. Returns the decision; only records on success.
+     *
+     * Not atomic: the COUNT and the INSERT are separate statements, so under
+     * concurrent requests for the same key a few attempts beyond the limit can
+     * slip through (the window is a soft ceiling). That is acceptable for abuse
+     * mitigation — do not rely on it as a hard quota.
+     */
+    consume(db: DatabaseContext, scope: RateLimitScope, key: string | null | undefined, config: Config): Promise<RateLimitDecision>;
+}
+//# sourceMappingURL=RateLimiter.d.ts.map

package/dist/types/model/service/RateLimiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimiter.d.ts","sourceRoot":"","sources":["../../../../src/model/service/RateLimiter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAG1C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAGrD,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,EAA+B,CAAA;CAChD;AAED,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CACnC;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,WAAW;IAEtB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,KAAK,CAAC;IAG5D,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,aAAa;IAkBrB;;;OAGG;IACG,KAAK,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAa1G,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpF;;;;;;;OAOG;IACG,OAAO,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAUrI"}

package/dist/types/model/service/RolesManager.d.ts

@@ -1,5 +1,5 @@
-import { DatabaseContext } from '../utils';
-import { Response } from '../utils/Response';
+import { DatabaseContext } from '../utils/index.js';
+import { Response } from '../utils/Response.js';
 export declare class RolesManager {
     addGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>>;
     removeGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>>;

package/dist/types/model/service/RolesManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RolesManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/RolesManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAE1C,OAAO,EAAE,QAAQ,EAA6B,MAAM,mBAAmB,CAAA;AAGvE,qBAAa,YAAY;IAClB,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAIvI,iBAAiB,CAAC,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;YAIlI,gBAAgB;IAiB9B,OAAO,CAAC,aAAa;CAQrB;AAED,KAAK,oBAAoB,GACtB,oBAAoB,GACpB,cAAc,CAAA"}
+{"version":3,"file":"RolesManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/RolesManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAG1E,qBAAa,YAAY;IAClB,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAIvI,iBAAiB,CAAC,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;YAIlI,gBAAgB;IAiB9B,OAAO,CAAC,aAAa;CAQrB;AAED,KAAK,oBAAoB,GACtB,oBAAoB,GACpB,cAAc,CAAA"}

package/dist/types/model/service/SecretsManager.d.ts

@@ -1,9 +1,12 @@
-import { Providers } from '../providers';
-import { DatabaseContext } from '../utils';
+import { Providers } from '../providers.js';
+import { ProjectSecretInfoRow } from '../queries/index.js';
+import { DatabaseContext } from '../utils/index.js';
 export declare class SecretsManager {
     private providers;
     constructor(providers: Providers);
     setSecret(dbContext: DatabaseContext, projectId: string, key: string, value: string): Promise<void>;
+    /** Lists secret keys (with timestamps) without decrypting any values. */
+    listSecretKeys(dbContext: DatabaseContext, projectId: string): Promise<ProjectSecretInfoRow[]>;
     readSecrets(dbContext: DatabaseContext, projectId: string): Promise<Record<string, string>>;
     private setSecrets;
 }

package/dist/types/model/service/SecretsManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecretsManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/SecretsManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAExC,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAE1C,qBAAa,cAAc;IACd,OAAO,CAAC,SAAS;gBAAT,SAAS,EAAE,SAAS;IAE3B,SAAS,CAAC,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInG,WAAW,CAAC,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAO1F,UAAU;CAWxB"}
+{"version":3,"file":"SecretsManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/SecretsManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,oBAAoB,EAA+C,MAAM,qBAAqB,CAAA;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,qBAAa,cAAc;IACd,OAAO,CAAC,SAAS;gBAAT,SAAS,EAAE,SAAS;IAE3B,SAAS,CAAC,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhH,yEAAyE;IAC5D,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAI9F,WAAW,CAAC,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAO1F,UAAU;CAWxB"}

package/dist/types/model/service/SignInManager.d.ts

@@ -1,24 +1,85 @@
-import { CreateSessionTokenErrorCode, SignInErrorCode } from '../../schema';
-import { ApiKeyManager, OtpAuthenticator } from '../service';
-import { PersonRow, PersonUniqueIdentifier } from '../queries';
-import { Providers } from '../providers';
-import { DatabaseContext } from '../utils';
-import { Response } from '../utils/Response';
-import { AuthLogService } from './AuthLogService';
+import { CreateSessionTokenErrorCode, MfaEnrollment, SignInErrorCode } from '../../schema/index.js';
+import { ApiKeyManager, AuthPolicyResolver, BackupCodeManager, EmailOtpManager, LoginRiskAnalyzer, OtpManager } from '../service/index.js';
+import { PersonRow, PersonUniqueIdentifier } from '../queries/index.js';
+import { Config } from '../type/Config.js';
+import { Providers } from '../providers.js';
+import { DatabaseContext } from '../utils/index.js';
+import { Response } from '../utils/Response.js';
+import { AuthLogService } from './AuthLogService.js';
+import { UserMailer } from '../mailing/index.js';
+import { ApiKeyRequestInfo } from '../commands/index.js';
 declare class SignInManager {
     private readonly apiKeyManager;
     private readonly providers;
-    private readonly otpAuthenticator;
-    constructor(apiKeyManager: ApiKeyManager, providers: Providers, otpAuthenticator: OtpAuthenticator);
-    signIn(dbContext: DatabaseContext, email: string, password: string, expiration?: number, otpCode?: string): Promise<SignInResponse>;
-    createSessionToken(dbContext: DatabaseContext, personIdentifier: PersonUniqueIdentifier, expiration?: number, verifier?: (person: PersonRow) => Promise<void>): Promise<CreateSessionTokenResponse>;
+    private readonly otpManager;
+    private readonly backupCodeManager;
+    private readonly emailOtpManager;
+    private readonly authPolicyResolver;
+    private readonly loginRiskAnalyzer;
+    private readonly userMailer;
+    constructor(apiKeyManager: ApiKeyManager, providers: Providers, otpManager: OtpManager, backupCodeManager: BackupCodeManager, emailOtpManager: EmailOtpManager, authPolicyResolver: AuthPolicyResolver, loginRiskAnalyzer: LoginRiskAnalyzer, userMailer: UserMailer);
+    signIn(dbContext: DatabaseContext, email: string, password: string, expiration?: number, otpCode?: string, requestInfo?: ApiKeyRequestInfo, trustForwardedInfo?: boolean, backupCode?: string, config?: Config, geoCountry?: string): Promise<SignInResponse>;
+    /**
+     * A03 — evaluate the sign-in risk score and act per policy. Returns:
+     * - `null` when anomaly detection is off or no `config` was supplied (the
+     *   default): no DB work, sign-in proceeds unchanged.
+     * - `{ unusualLoginDetected: true }` when an informational UNUSUAL_LOGIN email
+     *   was sent (best-effort) but the session may still be issued.
+     * - a `ResponseError('OTP_REQUIRED')` when step-up is required and no code was
+     *   supplied — reuses the email-OTP step-up channel (dispatches a code).
+     * - a `ResponseError('INVALID_OTP_TOKEN')` when a step-up code was supplied but
+     *   did not verify. A valid code consumes the token and the session is issued.
+     * - `{ unusualLoginDetected: false }` when the score was below every threshold.
+     *
+     * The audit entries (`unusual_login_detected`, `step_up_required`) are emitted
+     * by the resolver from the response metadata, matching the project convention.
+     */
+    private applyRiskPolicy;
+    private sendUnusualLoginEmail;
+    /**
+     * A06 enforcement for the no-active-factor case. Returns:
+     * - `null` when MFA is not required, or grace currently allows sign-in
+     *   (caller proceeds to issue a session as normal). With zero auth_policy
+     *   rows this is always the outcome — no behavior change.
+     * - a `ResponseError` (MFA_ENROLLMENT_REQUIRED with the pending secret to
+     *   enroll, or INVALID_OTP_TOKEN) when sign-in must be blocked.
+     * - `{ ok: true, backupCodes }` when enrollment just completed (pending TOTP
+     *   promoted to active); caller issues the session.
+     */
+    private enforceMfaEnrollment;
+    createSessionToken(dbContext: DatabaseContext, personIdentifier: PersonUniqueIdentifier, expiration?: number, verifier?: (person: PersonRow) => Promise<void>, requestInfo?: ApiKeyRequestInfo, trustForwardedInfo?: boolean): Promise<CreateSessionTokenResponse>;
+}
+/** A03: greppable payload describing why a sign-in scored as unusual. */
+export interface RiskMeta {
+    readonly score: number;
+    readonly reasons: readonly string[];
 }
 export interface SignInResult {
     readonly person: PersonRow;
     readonly token: string;
+    /** True when MFA was satisfied by consuming a backup code (instead of a TOTP token). */
+    readonly usedBackupCode?: boolean;
+    /** Set when sign-in completed an MFA enrollment (A06): the freshly issued backup codes, shown once. */
+    readonly backupCodes?: string[];
+    /** A03: true when this sign-in scored as unusual and an UNUSUAL_LOGIN email was sent. */
+    readonly unusualLoginDetected?: boolean;
+    /** A03: the risk score + reasons, recorded in the `unusual_login_detected` audit `event_data`. */
+    readonly risk?: RiskMeta;
     [AuthLogService.Key]: AuthLogService.Bag;
 }
 export type SignInResponse = Response<SignInResult, SignInErrorCode, {
+    /** Set on an OTP_REQUIRED error when an email-OTP code was just dispatched (A05). */
+    emailOtpSent?: boolean;
+    /** Set on a MFA_ENROLLMENT_REQUIRED error (A06): triggers the `mfa_enrollment_required` audit. */
+    mfaEnrollmentRequired?: boolean;
+    /** Set on a MFA_ENROLLMENT_REQUIRED error (A06): the pending secret the client must enroll. */
+    mfaEnrollment?: MfaEnrollment;
+    /** Set on an OTP_REQUIRED error raised by A03 anomaly step-up: triggers the `step_up_required` audit. */
+    stepUpRequired?: boolean;
+    /** A03: true when the sign-in scored as unusual (triggers the `unusual_login_detected` audit). */
+    unusualLoginDetected?: boolean;
+    /** A03: the risk score + reasons, recorded in the audit `event_data`. */
+    risk?: RiskMeta;
     [AuthLogService.Key]: AuthLogService.Bag;
 }>;
 export type CreateSessionTokenResponse = Response<SignInResult, CreateSessionTokenErrorCode, {

package/dist/types/model/service/SignInManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SignInManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/SignInManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC3E,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC5D,OAAO,EAAe,SAAS,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,EAAE,QAAQ,EAA6B,MAAM,mBAAmB,CAAA;AAEvE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEjD,cAAM,aAAa;IAEjB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;gBAFhB,aAAa,EAAE,aAAa,EAC5B,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,gBAAgB;IAG9C,MAAM,CAAC,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IA8CnI,kBAAkB,CACvB,SAAS,EAAE,eAAe,EAC1B,gBAAgB,EAAE,sBAAsB,EACxC,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,GAC7C,OAAO,CAAC,0BAA0B,CAAC;CA2CtC;AAED,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CACxC;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,YAAY,EAAE,eAAe,EAAE;IACpE,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CACxC,CAAC,CAAA;AACF,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC,YAAY,EAAE,2BAA2B,EAAE;IAC5F,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CACxC,CAAC,CAAA;AAEF,OAAO,EAAE,aAAa,EAAE,CAAA"}
+{"version":3,"file":"SignInManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/SignInManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACnG,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAC1I,OAAO,EAAmC,SAAS,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AACxG,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAE1E,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAA2B,MAAM,sBAAsB,CAAA;AAGjF,cAAM,aAAa;IAEjB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAPV,aAAa,EAAE,aAAa,EAC5B,SAAS,EAAE,SAAS,EACpB,UAAU,EAAE,UAAU,EACtB,iBAAiB,EAAE,iBAAiB,EACpC,eAAe,EAAE,eAAe,EAChC,kBAAkB,EAAE,kBAAkB,EACtC,iBAAiB,EAAE,iBAAiB,EACpC,UAAU,EAAE,UAAU;IAGlC,MAAM,CACX,SAAS,EAAE,eAAe,EAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,MAAM,EAChB,WAAW,CAAC,EAAE,iBAAiB,EAC/B,kBAAkB,CAAC,EAAE,OAAO,EAC5B,UAAU,CAAC,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,cAAc,CAAC;IAwJ1B;;;;;;;;;;;;;;OAcG;YACW,eAAe;YA4Ef,qBAAqB;IAgBnC;;;;;;;;;OASG;YACW,oBAAoB;IA4E5B,kBAAkB,CACvB,SAAS,EAAE,eAAe,EAC1B,gBAAgB,EAAE,sBAAsB,EACxC,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,EAC/C,WAAW,CAAC,EAAE,iBAAiB,EAC/B,kBAAkB,CAAC,EAAE,OAAO,GAC1B,OAAO,CAAC,0BAA0B,CAAC;CA2CtC;AAED,yEAAyE;AACzE,MAAM,WAAW,QAAQ;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAkBD,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,wFAAwF;IACxF,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,uGAAuG;IACvG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IAC/B,yFAAyF;IACzF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAA;IACvC,kGAAkG;IAClG,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAA;IACxB,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CACxC;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,YAAY,EAAE,eAAe,EAAE;IACpE,qFAAqF;IACrF,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,kGAAkG;IAClG,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,+FAA+F;IAC/F,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,yGAAyG;IACzG,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,kGAAkG;IAClG,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,yEAAyE;IACzE,IAAI,CAAC,EAAE,QAAQ,CAAA;IACf,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CACxC,CAAC,CAAA;AACF,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC,YAAY,EAAE,2BAA2B,EAAE;IAC5F,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CACxC,CAAC,CAAA;AAEF,OAAO,EAAE,aAAa,EAAE,CAAA"}

package/dist/types/model/service/SignOutManager.d.ts

@@ -0,0 +1,31 @@
+import { ApiKeyManager } from './apiKey/index.js';
+import { DatabaseContext } from '../utils/index.js';
+import { IDPHandlerRegistry } from './idp/IDPHandlerRegistry.js';
+import { Response } from '../utils/Response.js';
+export type SignOutErrorCode = 'NOT_A_PERSON' | 'NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY';
+export type SignOutResult = {
+    /** Set when the session was federated via an OIDC IdP that exposes RP-initiated logout. */
+    readonly logoutUrl: string | null;
+    /** The IdP this session belonged to, for auditing. Null for plain (password) sessions. */
+    readonly identityProviderId: string | null;
+};
+export type SignOutResponse = Response<SignOutResult, SignOutErrorCode>;
+/**
+ * Owns the sign-out flow (extracted from `SignOutMutationResolver`, A10):
+ *   - the existing local logout (disable this session, or all of the identity's sessions);
+ *   - OIDC Single Logout — when the session was federated and the IdP advertises an
+ *     `end_session_endpoint`, build the RP-initiated (front-channel) logout redirect URL the admin
+ *     should send the browser to. Legacy IdPs without `end_session_endpoint` (and password
+ *     sessions) gracefully fall back to a local-only logout with no `logoutUrl`.
+ *
+ * Auditing lives at the resolver layer (the manager only returns what happened), matching the
+ * existing convention.
+ */
+export declare class SignOutManager {
+    private readonly apiKeyManager;
+    private readonly idpRegistry;
+    constructor(apiKeyManager: ApiKeyManager, idpRegistry: IDPHandlerRegistry);
+    signOut(db: DatabaseContext, identityId: string, apiKeyId: string, all: boolean): Promise<SignOutResponse>;
+    private resolveOidcLogout;
+}
+//# sourceMappingURL=SignOutManager.d.ts.map

package/dist/types/model/service/SignOutManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignOutManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/SignOutManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAInD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAChE,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAE1E,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG,8CAA8C,CAAA;AAE9F,MAAM,MAAM,aAAa,GAAG;IAC3B,2FAA2F;IAC3F,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,0FAA0F;IAC1F,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1C,CAAA;AAED,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAA;AAEvE;;;;;;;;;;GAUG;AACH,qBAAa,cAAc;IAEzB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW;gBADX,aAAa,EAAE,aAAa,EAC5B,WAAW,EAAE,kBAAkB;IAG3C,OAAO,CACZ,EAAE,EAAE,eAAe,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,OAAO,GACV,OAAO,CAAC,eAAe,CAAC;YA8Bb,iBAAiB;CAsC/B"}